Equipment communication methods, devices, storage media and electronic devices

Abstract

This invention provides a device communication method, apparatus, storage medium, and electronic device. The method includes: acquiring first data to be sent and an encryption public key; encrypting the first data according to a first symmetric key generated by the first device to obtain first data ciphertext; and encrypting the first symmetric key according to a second local area network address and the encryption public key to obtain first key ciphertext. This invention solves the problem in related technologies where device communication schemes are complex, resulting in low efficiency of secure communication between devices.

Description

Technical Field

[0001] The present invention relates to the field of computers, and more specifically, to a device communication method, apparatus, storage medium, and electronic device. Background Technology

[0002] Currently, in related technologies, secure communication between devices mainly relies on certificate trust methods. A key authority issues certificates and private keys to multiple devices, which then pre-import the certificates of the peer devices and perform two-way authentication, negotiating a symmetric key. Subsequent communication is encrypted using this negotiated symmetric key. This requires multiple interactions to achieve secure communication. Furthermore, the certificate authentication in this scheme is dependent on a third-party certificate authority, requiring all devices to pre-apply for certificates. This authentication process is complex and results in low efficiency for secure communication between devices.

[0003] There is currently no effective solution to the problems of complex device communication schemes and low efficiency of secure communication between devices in related technologies. Summary of the Invention

[0004] This invention provides a device communication method, apparatus, storage medium, and electronic device to at least solve the problem that the device communication schemes in related technologies are relatively complex, resulting in low efficiency of secure communication between devices.

[0005] According to an embodiment of the present invention, a device communication method is provided, comprising: acquiring first data to be sent and an encryption public key, wherein the encryption public key is a key for encrypting data that is allowed to be used by all devices within a target local area network, the first data is data that needs to be encrypted by a first device and sent to a second device, and both the first device and the second device are devices within the target local area network; encrypting the first data according to a first symmetric key generated by the first device to obtain a first data ciphertext; encrypting the first symmetric key according to a second local area network address and the encryption public key to obtain a first key ciphertext, wherein the second local area network address is the local area network address of the second device; and sending the first data ciphertext and the first key ciphertext to the second device.

[0006] According to another embodiment of the present invention, a device communication apparatus is provided, comprising: an acquisition module, configured to acquire first data to be sent and an encryption public key, wherein the encryption public key is a key for encrypting data that is allowed to be used by devices within a target local area network, the first data is data that needs to be encrypted by a first device and sent to a second device, and both the first device and the second device are devices within the target local area network; a first processing module, configured to encrypt the first data according to a first symmetric key generated by the first device to obtain first data ciphertext; a second processing module, configured to encrypt the first symmetric key according to a second local area network address and the encryption public key to obtain first key ciphertext, wherein the second local area network address is the local area network address of the second device; and a sending module, configured to send the first data ciphertext and the first key ciphertext to the second device.

[0007] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0008] According to yet another embodiment of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0009] This invention solves the problem in related technologies where complex device communication schemes lead to low efficiency in secure communication between devices. By acquiring the first data to be sent and the encryption public key, encrypting the first data using the first symmetric key generated by the first device to obtain the first data ciphertext, and encrypting the first symmetric key using the second local area network address and the encryption public key to obtain the first key ciphertext, this invention achieves the technical effects of improving device communication efficiency, simplifying the authentication process between devices, improving deployment and authentication efficiency, and reducing network transmission layer consumption. Attached Figure Description

[0010] Figure 1 This is a hardware structure block diagram of a mobile terminal for a device communication method according to an embodiment of the present invention;

[0011] Figure 2 This is a flowchart of a device communication method according to an embodiment of the present invention;

[0012] Figure 3 This is a schematic diagram illustrating a specific example of a device communication method according to an embodiment of the present invention;

[0013] Figure 4This is a flowchart of a device communication method according to an embodiment of the present invention;

[0014] Figure 5 This is a structural block diagram of a device communication apparatus according to an embodiment of the present invention. Detailed Implementation

[0015] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0017] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a device communication method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0018] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the device communication method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0019] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0020] This embodiment provides a device communication method. Figure 2 This is a flowchart of a device communication method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0021] S202, Obtain the first data to be sent and the encryption public key, wherein the encryption public key is a key that is allowed to be used by all devices in the target local area network for encrypting data, the first data is the data that needs to be encrypted by the first device and sent to the second device, and both the first device and the second device are devices in the target local area network;

[0022] Optionally, in this embodiment, the first device and the second device can be tools capable of communication and data exchange, including but not limited to switches, bridges, and repeaters. For example, devices such as mobile phones, computers, tablets, and smartwatches. The relationship between the first device and the second device is not limited to many-to-many, many-to-one, or one-to-many, and the number of the first device and the second device is not limited here.

[0023] Optionally, in this embodiment, the first data mentioned above needs to be encrypted by the first device and sent to the second device, which may include, but is not limited to, confidential documents, pictures, audio, video and other data.

[0024] Optionally, in this embodiment, a local area network (LAN) is a regional network formed in a localized area, which may include, but is not limited to, wired LANs and wireless LANs. Its characteristic is that its distribution area is limited, ranging from a connection between adjacent buildings to a connection between offices. LANs themselves offer faster transmission speeds, more stable performance, and simpler frameworks compared to other networks. The aforementioned target LAN may include, but is not limited to, a private network, which can be a pre-deployed intranet environment used for resource sharing and information exchange, such as an enterprise intranet, school intranet, or factory intranet.

[0025] Optionally, in this embodiment, the aforementioned encryption public key is a key used to encrypt data that is allowed to be used by all devices within the target local area network. The fact that all devices within the target local area network are allowed to use it may include, but is not limited to, devices that have completed the preliminary deployment. The preliminary deployment may involve requesting the device's private key from the key center and obtaining the key center's master signature public key and master encryption public key. That is, this application can pre-set a key center, and all devices in the target local area network can obtain the device's private key corresponding to the device's local area network address, as well as the master signature public key and master encryption public key, from the key center.

[0026] S204, encrypt the first data according to the first symmetric key generated by the first device to obtain the first data ciphertext;

[0027] Optionally, in this embodiment, the first symmetric key may include, but is not limited to, the key used by the sender (first device) to encrypt data or the key used by the receiver (second device) to decrypt data. The first symmetric key is a symmetric key randomly generated by the first device when it needs to encrypt data. Encryption or decryption using this symmetric key is faster and suitable for encrypting large amounts of data.

[0028] Optionally, in this embodiment, the generation method of the first symmetric key may include, but is not limited to, a master key and a secondary key. The master key is generated by extracting true random numbers, and the secondary key is generated by determining pseudo-random numbers based on the true random numbers. For example, the master key is generated based on mechanical noise sources or electronic noise sources. For the generation of the secondary key, a true random secondary key can be generated in the same way as the master key. After the master key is generated, a secondary key can also be generated with the help of the master key and a strong cryptographic algorithm.

[0029] Two truly random numbers RN1 and RN2 are generated using the same method as generating the master key. Then, a random number RN3 is generated. These two numbers are then used as keys to perform multi-level encryption on an ordinal number, finally generating the secondary key K. N .

[0030] Generating secondary keys requires pseudo-random numbers. The requirements for pseudo-randomness include: long period, uniform distribution, independence, and nonlinearity. Generally, pseudo-random numbers are generated using methods based on strong cryptographic algorithms.

[0031] Optionally, in this embodiment, the first data ciphertext is obtained by encrypting the first data with the first symmetric key generated by the first device, and its form may include, but is not limited to, a string of numbers, characters, symbols, etc.

[0032] S206, encrypt the first symmetric key according to the second local area network address and the encryption public key to obtain the first key ciphertext, wherein the second local area network address is the local area network address of the second device;

[0033] Optionally, in this embodiment, the aforementioned second local area network address is the local area network address of the second device. It is an address used to confirm the location of the network device. Each device has only one specific local area network address. The local area network address can also be called a MAC address (Media Access Control Address), Ethernet address, or physical address, etc.

[0034] Optionally, in this embodiment, the aforementioned public encryption key may include, but is not limited to, the publicly disclosed portion of a key pair obtained through an encryption algorithm. This public encryption key can encrypt drawings and reverse-engineer data, verify digital signatures, and decrypt session data only using the corresponding private key, thereby ensuring data transmission security. The device's unique MAC address is used as the device-level private key. For example, the MAC address of the first device is used as the private key for the first device, and the MAC address of the second device is used as the private key for the second device, obtaining the master public encryption key from the key center.

[0035] Optionally, in this embodiment, the first key ciphertext is obtained by encrypting the first symmetric key, and the encryption is achieved by the second local area network address and the encryption public key. For example, if device A sends confidential data to device B, device A randomly generates a symmetric key K, and uses K to symmetrically encrypt the data to be sent to device B to obtain ciphertext X1. Then, K is encapsulated and encrypted using the MAC address of device B and the signature center's master encryption public key using an SM9 key to obtain ciphertext X2.

[0036] S208, the first data ciphertext and the first key ciphertext are sent to the second device.

[0037] Optionally, in this embodiment, the method of sending the first data ciphertext and the first key ciphertext to the second device may include, but is not limited to, the user of the first device sending the two ciphertexts to the social media account of the user of the second device via a social media account, or the first device sending them to the second device via Bluetooth, fax, etc. No limitation is made on the method of sending the ciphertexts here.

[0038] For example, Figure 3 This is a schematic diagram of a device communication method according to an embodiment of the present invention, such as... Figure 3 As shown, the above-mentioned device communication method includes, but is not limited to, the following steps:

[0039] S302, the first device requests the key center to obtain the SM9 private key, the master signature public key, and the master encryption public key;

[0040] S304, the key center sends the SM9 private key, the master signature public key, and the master encryption public key to the first device;

[0041] A random number R1 is generated. R1 is then SM9-signed to obtain a signature value S1, which in turn generates a symmetric key K. K is used to symmetrically encrypt the data to be sent to the second device, yielding ciphertext Ep. Finally, K is encapsulated and encrypted using the MAC address of the second device and the signature center's master encryption public key, resulting in ciphertext Ek.

[0042] S306, the first device sends R1+S1+Ep+Ek to the second device;

[0043] S308, the second device requests the key center to obtain the SM9 private key, the master signature public key, and the master encryption public key;

[0044] S310, the key center sends the SM9 private key, the master signature public key, and the master encryption public key to the second device;

[0045] Using the MAC address of the first device and the key center's signature master public key, perform SM9 signature verification on R1 and S1. If the verification passes, it indicates that the first device has verified its identity. For the second device, the first device is trustworthy because it possesses the private key corresponding to the MAC address of the first device issued by the key center. Use its own private key and MAC address to perform SM9 key decryption on Ek. The resulting symmetric key K is used to decrypt the ciphertext Ek, yielding the plaintext sent by device A.

[0046] The above is merely an example, and this application does not impose any specific limitations.

[0047] This application embodiment employs a method of obtaining first data to be sent and an encryption public key, wherein the encryption public key is a key that all devices within the target local area network are allowed to use for encrypting data, the first data is data that needs to be encrypted by a first device and sent to a second device, and both the first device and the second device are devices within the target local area network. The first data is encrypted using a first symmetric key generated by the first device to obtain first data ciphertext, and the first symmetric key is encrypted using a second local area network address and the encryption public key to obtain first key ciphertext, wherein the second local area network address is the local area network address of the second device. This method of sending the first data ciphertext and the first key ciphertext to the second device solves the problem of relatively complex device communication schemes in related technologies, leading to low display efficiency, and achieves the technical effect of improving device communication efficiency and simplifying device communication methods.

[0048] As an optional embodiment, the above method further includes: receiving a second data ciphertext and a second key ciphertext sent by a second device, wherein the second data ciphertext and the second key ciphertext are generated by the second device in the following manner: the second device obtains the second data to be sent and an encryption public key, the second data being data that needs to be encrypted by the second device and sent to the first device; encrypts the second data according to a second symmetric key generated by the second device to obtain the second data ciphertext; encrypts the second symmetric key according to a first local area network address and an encryption public key to obtain the second key ciphertext, the first local area network address being the local area network address of the first device; and decrypts the second data ciphertext and the second key ciphertext to obtain the second data.

[0049] Optionally, in this embodiment, the aforementioned second data ciphertext is obtained by encrypting the second data (data that needs to be encrypted by the second device and sent to the first device) using the second symmetric key generated by the second device. Its form may include, but is not limited to, a string of numbers, characters, symbols, etc. The aforementioned second key ciphertext is obtained by encrypting the second symmetric key, and its encryption is achieved through the combined action of the first local area network address and the encryption public key.

[0050] Optionally, in this embodiment, the aforementioned first local area network address is the local area network address of the first device. It is an address used to identify the location of the network device. Each device has only one unique local area network address. The local area network address can also be called a MAC address (Media Access Control Address), Ethernet address, or physical address, etc.

[0051] In this embodiment, a second device acquires the second data to be sent and an encryption public key. The second data is data that needs to be encrypted by the second device and sent to the first device. The second data is encrypted using a second symmetric key generated by the second device to obtain ciphertext. The second symmetric key is then encrypted using a first local area network address and an encryption public key to obtain ciphertext. The second data ciphertext and the second key ciphertext are decrypted to obtain the second data. This method enables the second device to generate both the second data ciphertext and the second key ciphertext, and subsequently receive the second data ciphertext and the second key ciphertext sent by the first device. This solves the problem of complex device communication schemes in related technologies, leading to low display efficiency, and achieves the technical effect of improving device communication efficiency and simplifying device communication methods.

[0052] As an optional embodiment, decrypting the second data ciphertext and the second key ciphertext to obtain the second data includes: decrypting the second key ciphertext using a first local area network address and a first encryption private key to obtain a second symmetric key, wherein the first device pre-stores the first encryption private key corresponding to the first local area network address; and decrypting the second data ciphertext using the second symmetric key to obtain the second data.

[0053] Optionally, in this embodiment, the first encrypted private key may include, but is not limited to, the first device obtaining it by requesting from a key center, the first encrypted private key being pre-stored in the first device, and the first encrypted private key and the first local address being corresponding, such as an SM9 private key.

[0054] SM9 is a standard for identity ciphers, primarily used in commercial cryptography for user authentication. The SM9 identity algorithm uses the user's identity identifier as the public key and does not rely on digital certificates. The SM9 algorithm mainly consists of a key part and an algorithm part:

[0055] The key component includes the master key pair (public and private keys) and the user's private key. The SM9 algorithm's keys are generated by the KGC (Key Generation Center) and mainly consist of the KGC's master key pair and the user's private key. The master key pair is divided into a signing master key pair and an encryption master key pair.

[0056] The algorithm section includes signature verification, key encapsulation and decapsulation, encryption and decryption, and key exchange algorithms. The SM9 algorithm comprises four main parts: signature verification, key encapsulation and decapsulation, encryption and decryption, and key exchange.

[0057] 1. Signature Algorithm: Uses the master public key and the signer's private key to sign data.

[0058] 2. Signature verification algorithm: Verify the signature using the master public key and the signer ID (Identity document).

[0059] 3. Key Encapsulation Algorithm: A symmetric key is encapsulated using the cryptographic master public key and the ID of the key decapsulator (the other party using the symmetric key).

[0060] 4. Key decryption algorithm: The sealed symmetric key is decrypted using the encryption master public key and the key decryptor ID.

[0061] 5. Encryption Algorithm: Data is encrypted using the master public key and the decryptor ID.

[0062] 6. Decryption Algorithm: Decrypt the data using the decryptor's private encryption key and decryptor ID.

[0063] 7. Key exchange algorithm: The two parties use the master public key, their own private key, and each other's IDs to negotiate a shared key.

[0064] By employing the first local area network address and the first encryption private key to decrypt the second key ciphertext to obtain the second symmetric key, and then using the second symmetric key to decrypt the second data ciphertext to obtain the second data, the method eliminates the need to issue and pre-embed certificates and private keys for each device. This solves the problem of complex device communication schemes leading to low device efficiency in related technologies, and achieves the technical effect of simplifying the authentication process between devices and improving deployment and authentication efficiency.

[0065] As an optional embodiment, the above method further includes: receiving a second random number, a second signature value, a second data ciphertext, and a second key ciphertext jointly sent by the second device, wherein the second random number and the second signature value are generated by the second device in the following manner: the second device obtains the second random number and a signing public key, the signing public key being a public key that is allowed to be used by all devices within the target local area network for signing encrypted ciphertext; the second random number is signed according to the second encryption private key and the signing public key to obtain a second signature value, the second device pre-stores a second encryption private key corresponding to the second local area network address; the second random number and the second signature value are verified to obtain a target verification result; if the target verification result indicates that the second device is a trusted device, the second data ciphertext and the second key ciphertext are decrypted to obtain the second data.

[0066] Optionally, in this embodiment, the second random number can be a number randomly generated by the second device. This random number is generated by a random number generator and can be an integer or not, with random integers being the most commonly used. Methods for generating random numbers may include, but are not limited to:

[0067] 1) Physical random number generators: True random numbers are generated using physical phenomena, such as tossing coins, dice, spinning wheels, noise from electronic components, nuclear fission, etc.

[0068] 2) Computer-generated true random numbers: The method of using a computer to generate true random numbers is to take into account the uncertainty of CPU frequency and temperature, the fact that the number of calculations over a period of time will produce different values ​​each time, system time errors, and sound card noise, etc.

[0069] 3) Generating functions: Random number generation functions in computer programming languages ​​and software.

[0070] Optionally, in this embodiment, the second signature value is obtained by signing the second random number using the second encryption private key and the signing public key; the signing public key is a public key that is allowed to be used by all devices within the target local area network to sign encrypted ciphertext; the second encryption private key may include, but is not limited to, the second device obtaining it by requesting from a key center, the second encryption private key being pre-stored in the second device, and the second encryption private key and the second local area address being corresponding and not arbitrarily changed; the target verification result may include, but is not limited to, the result obtained after verifying the second random number and the second signature value, which may include verification passed and verification failed, wherein verification passed indicates that the second device is trustworthy, and under the condition that the second device is trustworthy, the second data ciphertext and the second key ciphertext are decrypted to obtain the second data.

[0071] In this embodiment, a second device obtains a second random number and a signature public key. The signature public key is a public key that all devices within the target local area network are allowed to use to sign encrypted ciphertext. The second random number is signed according to the second encryption private key and the signature public key to obtain a second signature value. The second device pre-stores a second encryption private key corresponding to the second local area network address. The second random number and the second signature value are verified to obtain a target verification result. If the target verification result indicates that the second device is a trusted device, the second data ciphertext and the second key ciphertext are decrypted to obtain the second data. The second random number, the second signature value, the second data ciphertext, and the second key ciphertext are received together by the second device. The method of sending authentication information (the second random number and the second signature value) and valid sensitive information (the second data ciphertext and the second key ciphertext) together reduces the message interaction process and improves the efficiency of authentication and information interaction.

[0072] As an optional embodiment, the above method further includes: when the target signature verification result indicates that the second device is a trusted device, receiving third data ciphertext and third key ciphertext sent by the second device, wherein the third data ciphertext and third key ciphertext are generated by the second device in the following manner: the second device obtains the third data to be sent and the encryption public key, the third data being the data that needs to be encrypted by the second device and sent to the first device; encrypts the third data according to the third symmetric key to obtain the third data ciphertext; encrypts the third symmetric key according to the first local area network address and the encryption public key to obtain the third key ciphertext; and directly decrypts the third data ciphertext and the third key ciphertext to obtain the third data.

[0073] Optionally, in this embodiment, the aforementioned trusted device can be a device that receives data and verifies the random number and signature value generated and sent by the data sending device, and the verification result is successful. Alternatively, it can be a device that has already conducted more than a preset number of communications.

[0074] Optionally, in this embodiment, the aforementioned third data ciphertext is obtained by encrypting the third data (data that needs to be encrypted by the second device and sent to the first device) through the second device (trusted device) using the second symmetric key. Its form may include, but is not limited to, a string of numbers, characters, symbols, etc. The aforementioned third key ciphertext is obtained by encrypting the second symmetric key, and its encryption is achieved through the combined action of the first local area network address and the encryption public key.

[0075] It should be noted that the preset number of communications may include, but is not limited to, those set in advance by the receiving party according to its own needs, and this number is greater than or equal to 1. The aforementioned third data ciphertext and third key ciphertext are generated by the second device. The first device will only receive and decrypt them if the second device is a trusted device. Conversely, if the second device is not a trusted device, the third data ciphertext and third key ciphertext will not be received by the first device.

[0076] In this embodiment, a second device acquires the third data to be sent and the encryption public key. The third data is data that needs to be encrypted by the second device and sent to the first device. The third data is encrypted using a third symmetric key to obtain ciphertext. The third symmetric key is then encrypted using a first local area network address and the encryption public key to obtain ciphertext. The ciphertext and key are directly decrypted to generate the third data ciphertext and third key ciphertext. If the target verification result indicates that the second device is a trusted device, the third data ciphertext and third key ciphertext sent by the second device are received. For devices that have undergone signature verification, subsequent communication can directly omit the signature verification process and directly exchange ciphertext and data. This solves the problem of complex device communication schemes and low device communication efficiency in related technologies, achieving the technical effect of improving device communication efficiency and simplifying device communication methods.

[0077] As an optional embodiment, verifying the second random number and the second signature value to obtain the target verification result includes: verifying the second random number and the second signature value using the second local area network address and the signature public key to obtain the target verification result.

[0078] As an optional embodiment, the above method further includes: obtaining a first random number and a signing public key, wherein the signing public key is a public key that is allowed to be used by all devices in the target local area network to sign encrypted ciphertext, and the first random number is a random number generated by a first device; signing the first random number according to a first encryption private key and a signing public key to obtain a first signature value, wherein the first device pre-stores a first encryption private key corresponding to a first local area network address; and sending the first random number, the first signature value, the first data ciphertext, and the first key ciphertext together to a second device.

[0079] Optionally, in this embodiment, the first random number can be a number randomly generated by the first device. This random number is generated by a random number generator and can be an integer or not, with random integers being the most commonly used. The first signature value is obtained by signing the first random number using a first encryption private key and a signing public key.

[0080] Through the embodiments of this application, a method is adopted in which a first random number and a signature public key are obtained, the first random number is signed according to the first encryption private key and the signature public key to obtain a first signature value, and the first random number, the first signature value, the first data ciphertext and the first key ciphertext are sent together to the second device. This method adopts a scheme of sending authentication information and valid sensitive information together, which reduces message interaction, improves authentication and information interaction efficiency, and solves the problem that the device communication scheme is relatively complex in related technologies, resulting in low device communication efficiency. This achieves the technical effect of improving device communication efficiency and simplifying device communication methods.

[0081] The present invention will be described in detail below with reference to specific embodiments:

[0082] This application can perform identity authentication based on the SM9 national cryptographic identification algorithm. For the SM9 identification algorithm, the public key or certificate does not need to be pre-signed and imported in the format specified by the CA. This solution uses the device's unique MAC address as the device's public key. By requesting the device's SM9 private key from the key center and obtaining the key center's main signature public key and main encryption public key, the initial deployment is completed without the need to import other certificates or keys.

[0083] Figure 4 This is a flowchart of secure communication between devices A and B. When device A communicates securely with device B, the devices perform the following steps:

[0084] (1) Device A obtains the MAC address of device B through ARP (Address Resolution Protocol).

[0085] (2) Device A generates a random number R1, and then uses the private key of Device A and the master signature public key of the key center to perform SM9 signature on the random number R1 to obtain the signature value S1.

[0086] (3) Device A randomly generates a symmetric key K, and uses K to symmetrically encrypt the data to be sent to Device B to obtain ciphertext Ep. Then, it uses the MAC address of Device B and the master encryption public key of the signature center to encapsulate and encrypt K with an SM9 key to obtain ciphertext Ek.

[0087] (4) Device A sends the random number R1 + signature value S1 + Ep + Ek to device B via unicast.

[0088] (5) Device B uses the MAC address of Device A and the key center's signature master public key to perform SM9 signature verification on R1 and S1. If the signature verification is successful, it means that Device A has identified itself. For Device B, Device A is trustworthy because Device A is certain to have the private key corresponding to the MAC address of Device A issued by the key center.

[0089] (6) Device B uses its own private key and MAC to decrypt the SM9 key of Ek, thus obtaining the symmetric key K.

[0090] (7) Device B uses the symmetric key K to decrypt the ciphertext Ek to obtain the plaintext sent by device A.

[0091] (8) Similarly, when device B replies, it generates a random number R2, and then uses the device's private key and the key center's master signature public key to perform SM9 signing on the random number R2 to obtain the signature value S2. A random key K' is generated to perform symmetric encryption on the data to be sent to obtain the ciphertext Ep'. The key center's master encryption public key and device A's MAC address are used to encapsulate K' with an SM9 key to obtain Ek'. R2+S2+Ep'+Ek' is then unicasted to device A.

[0092] (9) Device A uses the MAC address of Device B and the signature master public key of the key center to perform SM9 signature verification on R2 and S2. If the signature verification is successful, it means that Device B has identified itself, and Device B is trusted by Device A because Device B is certain to possess the private key corresponding to the MAC address of Device B issued by the key center. At this point, Ep' and Ek' can be decrypted.

[0093] For devices A and B that have already undergone signature verification once, subsequent interactions can skip the random number signature verification process and directly proceed to the exchange of key ciphertext and data ciphertext.

[0094] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0095] This embodiment also provides a device communication apparatus for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0096] Figure 5 This is a structural block diagram of a device communication apparatus according to an embodiment of the present invention, such as... Figure 5 As shown, the device includes:

[0097] The acquisition module 502 is used to acquire the first data to be sent and the encryption public key. The encryption public key is a key that is allowed to be used by all devices in the target local area network to encrypt data. The first data is data that needs to be encrypted by the first device and sent to the second device. Both the first device and the second device are devices in the target local area network.

[0098] The first processing module 504 is used to encrypt the first data according to the first symmetric key generated by the first device to obtain the first data ciphertext;

[0099] The second processing module 506 is used to encrypt the first symmetric key according to the second local area network address and the encryption public key to obtain the first key ciphertext, wherein the second local area network address is the local area network address of the second device;

[0100] The sending module 508 is used to send the first data ciphertext and the first key ciphertext to the second device.

[0101] The above-mentioned device also includes:

[0102] The first acquisition unit and the second device acquire the second data to be sent and the encryption public key. The second data is data that needs to be encrypted by the second device and sent to the first device. The second device encrypts the second data according to the second symmetric key generated by the second device to obtain the ciphertext of the second data.

[0103] The first processing unit is used to encrypt the second symmetric key according to the first local area network address and the encryption public key to obtain the second key ciphertext. The first local area network address is the local area network address of the first device.

[0104] The second processing unit is used to decrypt the second data ciphertext and the second key ciphertext to obtain the second data.

[0105] The above-mentioned device also includes:

[0106] The third processing unit uses the first local area network address and the first encryption private key to decrypt the second key ciphertext to obtain the second symmetric key. The first device pre-stores the first encryption private key corresponding to the first local area network address.

[0107] The fourth processing unit uses the second symmetric key to decrypt the second data ciphertext and obtain the second data.

[0108] The above-mentioned device also includes:

[0109] The first receiving unit is configured to receive a second random number, a second signature value, a second data ciphertext, and a second key ciphertext jointly sent by the second device, wherein the second random number and the second signature value are generated by the second device in the following manner:

[0110] The second acquisition unit and the second device acquire a second random number and a signature public key. The signature public key is a public key that is allowed to be used by all devices in the target local area network to sign encrypted ciphertext. The second random number is signed according to the second encryption private key and the signature public key to obtain a second signature value. The second device has a second encryption private key corresponding to the second local area network address stored in advance.

[0111] The fifth processing unit is used to verify the second random number and the second signature value to obtain the target signature verification result;

[0112] The sixth processing unit is used to decrypt the second data ciphertext and the second key ciphertext to obtain the second data when the target verification result indicates that the second device is a trusted device.

[0113] The above-mentioned device also includes:

[0114] The second receiving unit is configured to receive the third data ciphertext and the third key ciphertext sent by the second device when the target verification result indicates that the second device is a trusted device. The third data ciphertext and the third key ciphertext are generated by the second device in the following manner:

[0115] The third acquisition unit, the second device acquires the third data to be sent and the encryption public key, the third data is the data that needs to be encrypted by the second device and sent to the first device;

[0116] The seventh processing unit is used to encrypt the third data according to the third symmetric key to obtain the ciphertext of the third data;

[0117] The eighth processing unit is used to encrypt the third symmetric key according to the first local area network address and the encryption public key to obtain the third key ciphertext;

[0118] The ninth processing unit is used to directly decrypt the third data ciphertext and the third key ciphertext to obtain the third data.

[0119] The above-mentioned device also includes:

[0120] The tenth processing unit uses the second local area network address and the signature public key to verify the second random number and the second signature value, and obtains the target signature verification result.

[0121] The above-mentioned device also includes:

[0122] The fourth acquisition unit is used to acquire a first random number and a signing public key, wherein the signing public key is a public key that is allowed to be used by all devices in the target local area network to sign encrypted ciphertext, and the first random number is a random number generated by the first device.

[0123] The eleventh processing unit is used to sign the first random number according to the first encryption private key and the signing public key to obtain the first signature value, wherein the first device pre-stores the first encryption private key corresponding to the first local area network address;

[0124] The sending unit is used to send the first random number, the first signature value, the first data ciphertext, and the first key ciphertext to the second device.

[0125] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to perform the steps in any of the above method embodiments when it is run.

[0126] In one exemplary embodiment, the apparatus is configured to include, in the following manner:

[0127] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0128] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0129] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0130] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0131] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0132] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0133] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0134] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A device communication method, characterized by, The method comprises: obtaining first data to be sent and an encryption public key, wherein the encryption public key is a key for encrypting data that is allowed to be used by devices in a target local area network, the first data is data that needs to be encrypted and sent by a first device to a second device, and the first device and the second device are both devices in the target local area network; encrypting the first data according to a first symmetric key generated by the first device to obtain first data ciphertext, wherein the first symmetric key comprises a master key and a secondary key, the master key is generated by extracting a true random number, and the secondary key is generated according to a pseudo random number determined according to the true random number; encrypting the first symmetric key according to a second local area network address and the encryption public key to obtain first key ciphertext, wherein the second local area network address is a local area network address of the second device; sending the first data ciphertext and the first key ciphertext to the second device, determining a physical address of the first device as a private key corresponding to the first device, and determining a physical address of the second device as a private key corresponding to the second device; The method further comprises: receiving a second random number, a second signature value, second data ciphertext and second key ciphertext sent by the second device, wherein the second data ciphertext and the second key ciphertext are generated by the second device in the following manner: the second device obtains second data to be sent to the first device and the encryption public key; encrypts the second data according to a second symmetric key generated by the second device to obtain the second data ciphertext; encrypts the second symmetric key according to a first local area network address of the first device and the encryption public key to obtain the second key ciphertext; the second device generates the second random number and the second signature value in the following manner: the second device obtains the second random number and a signature public key, the signature public key is a public key for signing encrypted ciphertext that is allowed to be used by devices in the target local area network; signs the second random number according to a second encryption private key and the signature public key to obtain the second signature value, and the second device pre-stores the second encryption private key corresponding to the second local area network address; The method further comprises: verifying the second random number and the second signature value to obtain a target verification result; in a case where the target verification result indicates that the second device is a trusted device, decrypting the second data ciphertext and the second key ciphertext using the second local area network address and the signature public key to obtain the second data; in a case where the second device is the trusted device that has been subjected to signature verification, communication between the first device and the second device does not need to be verified, and interaction of key ciphertext and data ciphertext is directly performed.

2. The method of claim 1, wherein, The method further comprises: In a case where the target verification result indicates that the second device is a trusted device, receiving third data ciphertext and third key ciphertext sent by the second device, wherein the third data ciphertext and the third key ciphertext are generated by the second device in the following manner: the second device acquires third data to be sent and the encryption public key, the third data being data that needs to be encrypted and sent to the first device by the second device; encrypting the third data according to a third symmetric key to obtain the third data ciphertext; and encrypting the third symmetric key according to the first local area network address and the encryption public key to obtain the third key ciphertext; Directly decrypting the third data ciphertext and the third key ciphertext to obtain the third data.

3. The method of claim 1, wherein, The method further comprises: acquiring a first random number and a signature public key, wherein the signature public key is a public key allowed to be used by devices in the target local area network for signing encrypted ciphertext, and the first random number is a random number generated by the first device; signing the first random number according to a first encryption private key and the signature public key to obtain a first signature value, wherein the first device has pre-stored the first encryption private key corresponding to the first local area network address; sending the first random number, the first signature value, the first data ciphertext and the first key ciphertext to a second device.

4. An apparatus for communicating, comprising: comprise: an acquiring module, configured to acquire first data to be sent and an encryption public key, wherein the encryption public key is a key allowed to be used by devices in a target local area network for encrypting data, and the first data is data that needs to be encrypted and sent to a second device by a first device, the first device and the second device both being devices in the target local area network; a first processing module, configured to encrypt the first data according to a first symmetric key generated by the first device to obtain first data ciphertext, the first symmetric key comprising a primary key and a secondary key, the primary key being generated by extracting a true random number, and the secondary key being generated according to a pseudo random number determined according to the true random number; a second processing module, configured to encrypt the first symmetric key according to a second local area network address and the encryption public key to obtain first key ciphertext, wherein the second local area network address is a local area network address of the second device, a physical address of the first device being determined as a private key corresponding to the first device, and a physical address of the second device being determined as a private key corresponding to the second device; a sending module, configured to send the first data ciphertext and the first key ciphertext to the second device; and The device is further configured to receive a second random number, a second signature value, and second data ciphertext and second key ciphertext sent by the second device, wherein the second data ciphertext and the second key ciphertext are generated by the second device as follows: the second device obtains second data to be sent to the first device and the encryption public key; encrypts the second data according to a second symmetric key generated by the second device to obtain the second data ciphertext; encrypts the second symmetric key according to the first local area network address of the first device and the encryption public key to obtain the second key ciphertext; and the second random number and the second signature value are generated by the second device as follows: the second device obtains the second random number and a signature public key, the signature public key being a public key allowed to be used by devices in the target local area network to sign encrypted ciphertext; and signs the second random number according to a second encryption private key and the signature public key to obtain the second signature value, the second device pre-storing the second encryption private key corresponding to the second local area network address. The device is further configured to verify the second random number and the second signature value to obtain a target verification result; in a case where the target verification result indicates that the second device is a trusted device, decrypt the second data ciphertext and the second key ciphertext using the second local area network address and the signature public key to obtain the second data; and in a case where the second device is the trusted device that has been subjected to signature verification, communication between the first device and the second device does not need to be verified, and interaction of key ciphertext and data ciphertext is directly performed.

5. A computer readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 3. 6.An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 3.

Images